Storm-3168 and explicitly associated that Microsoft tracking designation with JADEPUFFER, the agentic threat actor originally discovered by Sysdig Threat Research Team in July 2026. This qualifies for the watch because it establishes a new vendor designation and actor mapping, rather than merely documenting another campaign. Microsoft

What is newly established

Microsoft says its investigation identified malicious Azure activity associated with JADEPUFFER and now tracks the activity as Storm-3168. Microsoft observed compromised service principals being used for reconnaissance, credential collection and extensive Azure resource destruction. Microsoft

This materially expands the actor profile. Sysdig originally documented JADEPUFFER exploiting an internet-facing Langflow instance through CVE-2025-3248, followed by an adaptive, LLM-driven attack that conducted reconnaissance, credential harvesting, lateral movement and destructive database extortion. Sysdig characterized JADEPUFFER as an agentic threat actor (ATA) and assessed the operation as the first documented end-to-end agentic ransomware operation. Sysdig

Sysdig subsequently observed the actor deploy ENCFORGE, a purpose-built, UPX-packed Go ransomware delivered as lockd. ENCFORGE targets roughly 180 file extensions associated with AI/ML infrastructure, including model checkpoints, vector databases, training datasets and embedding indexes. Sysdig

Newly documented Storm-3168 tradecraft

Microsoft observed two compromised service principals within one Azure tenant. One performed prolonged reconnaissance; the second conducted discovery, destructive actions and credential collection.

The destructive sequence was unusually fast: Microsoft recorded 150+ destructive or credential-related operations within 35 minutes, including more than 100 storage-account deletion attempts. The actor also targeted Azure SQL databases, Key Vault, Function Apps, App Services, recovery-protection locks and virtual-machine-related resources. Microsoft

Relevant ATT&CK behaviors documented by Microsoft include:

• T1190 — Exploit Public-Facing Application: probing Azure App Services, including LangFlow, PHP-CGI and WordPress paths.
• T1078.004 — Valid Accounts: Cloud Accounts: compromised service principals.
• T1526 — Cloud Service Discovery: enumeration of subscriptions, VMs, resource groups, storage, web apps and recovery resources.
• T1485 — Data Destruction: deletion of Azure resources.
• T1490 — Inhibit System Recovery: attempts against Site Recovery and Azure Backup protection locks. Microsoft

Microsoft additionally observed five different tokens associated with one compromised service principal, including overlapping tokens performing separate destructive functions. Microsoft assesses the timing, parallelism and division of operations as strongly indicative of automated or scripted execution. 

The earlier Sysdig investigation also ties JADEPUFFER to the ENCFORGE ransomware and the extortion email address [email protected]; Sysdig states that the same address appeared in both its original JADEPUFFER investigation and the later ENCFORGE operation, supporting continuity between the campaigns. Sysdig

Attribution confidence

Confirmed / high confidence: Microsoft explicitly maps Storm-3168 to JADEPUFFER. This is not an inference from overlapping TTPs; Microsoft states that the malicious activity is associated with JADEPUFFER and that Microsoft tracks the actor as Storm-3168. Microsoft

Confirmed: JADEPUFFER previously exploited Langflow via CVE-2025-3248 and subsequently deployed ENCFORGE against AI/ML infrastructure. Sysdig

Probable objective: Microsoft assesses the Azure destruction, attacks on recovery mechanisms and credential collection as consistent with activity that can support ransomware/extortion. However, Microsoft did not observe a ransom note or confirm successful data exfiltration in this particular Azure incident. It therefore should not be recorded as confirmed ransomware deployment for that specific intrusion. Microsoft

Unknown: I found no credible first-party evidence establishing Storm-3168/JADEPUFFER\'s country of operation, nationality, state sponsor, organizational identity or individual operators. I would leave the country/nexus field as UNKNOWN rather than infer one from hosting infrastructure or tooling.

Microsoft — Storm-3168 technical report, September 25, 2026

Sysdig — Original JADEPUFFER research, July 1, 2026

Sysdig — JADEPUFFER/ENCFORGE follow-up, July 20, 2026

I also checked recent reporting from Google/Mandiant, Cisco Talos, ESET, Kaspersky/Global Research & Analysis Team, Palo Alto Unit 42 and Microsoft. I excluded established actors receiving only new campaign reporting. Storm-3168/JADEPUFFER is the material new designation/attribution that meets the threshold for this watch cycle.